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Abstract. A conjugate code pair is defined as a pair of linear codes either 
of which contains the dual of the other. A conjugate code pair represents the 
essential structure of the corresponding Calderbank-Shor-Steane (CSS) quan- 
tum error-correcting code. It is known that conjugate code pairs are applicable 
to quantum cryptography. In this work, a polynomial construction of conju- 
gate code pairs is presented. The constructed pairs achieve the highest known 
achievable rate on additive channels, and are decodable with algorithms of 
polynomial complexity. 

1. Introduction. Algebraic coding has proved useful not only on 'classical' chan- 
nels, already in practical use, but also on 'quantum' channels, i.e., on those that 
behave in quantum theoretical manners. In particular, problems of secure informa- 
tion transmission through quantum channels in the presence of eavesdroppers have 
attracted great attention [IJ [2j [3] since a quantum key distribution protocol was 
proved secure without resort to unproven computational assumptions [SJ. 

On the one hand, there is a large literature of physics on design and analysis of 
physical layers of such systems. On the other hand, the design issue of codes in 
this context has left much room for investigation whereas the influential work [3] 
on quantum key distribution suggests that the key technique of such cryptographic 
systems is algebraic coding. 

Codes that can be used in cryptographic protocols, as well as for quantum error 
correction, have been treated in 4, 5,[6j[7], and the present work is a continuation. 
The codes of our concern here are essentially Calderbank-Shor-Steane (CSS) quan- 
tum codes as in [3) |H [6l [7]. For CSS codes, however, we use an almost synonym 
conjugate code pairs, which would represent the essence of CSS quantum codes. A 
conjugate code pair is defined as a pair of linear codes either of which contains the 
dual of the other. 
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This work presents an 'explicit', or more precisely, polynomial construction of 
conjugate code pairs. The constructed codes fall in the class of concatenated con- 
jugate codes recently proposed by the present author [7J. These are conjugate code 
pairs dually equipped with the structure of concatenated codes [8] . 

Recall there exist two major design criteria for error-correcting codes, or simply 
codes: (i) decoding error probability of a code, and (ii) minimum distance of a code. 
Whereas (ii) is adopted as a measure of the goodness of a code in [9] to show that 
the codes in [7J are better than those known, we adopt (i) in this paper. This would 
be legitimate in the context of Shannon theory. 

The remaining part of the paper is outlined here. After preliminaries are given 
in Section [2] the problem to be treated is described in Section [3] In Section 21 a 
'balanced' ensemble of conjugate codes is given, and then, it is argued that a good 
code exists in a balanced ensemble of codes. In fact, a large portion of a balanced 
ensemble is made of good codes. This fact is used in a polynomial construction of 
codes in Section [Jj while Sections [5] and [6J are devoted to explaining needed basic 
notions, i.e., quotient codes and concatenated conjugate codes, respectively. We 
conclude with a summary and remarks in Section [8] 

2. Preliminaries. To focus on the design issue of codes, we begin directly with 
treating codes over a finite field, and evaluate the performance of codes in terms of 
classical probabilities. How the evaluation implies the reliability and security of the 
corresponding quantum codes or cryptographic protocols can be found in [3] [H [5J . 

We fix our notation, and recall some useful tools here. As usual, [a\ denotes the 
largest integer a' with a' < a, and \a \ = — [ — aj . An [n,k] linear (error-correcting) 
code over a finite field ¥ q , the finite field of q elements, is a fc-dimensional subspace of 
F™. The dual of a linear code C C F£ is {y G F™ | \fx € C, x-y = 0} and denoted by 
C , where • denotes the ordinary (Euclidean) inner product. The method of types 
in information theory [10] lllj is a standard tool for elementary and combinatorial 
analysis on probabilities. Geometric Goppa codes (algebraic geometry codes) will 
be used in Section while the same achievable rate can be obtained with the more 
elementary Reed-Solomon (RS) codes with a slower speed of convergence of error 
probability to zero [12]. Whereas geometric Goppa codes were originally described 
in the language of algebraic geometry, these can, more directly, be described in the 
language of the function fields [13], which we will use. The notion of polynomial 
constructibility is well established in coding theory [TH p. 80], [HI p. 317]: A 
sequence of codes {C„} of growing length is said to be polynomially constructible 
or polynomial if their encoders or generator matrices of C„ are constructible with 
polynomial complexity in their code-length. Similarly our conjugate codes to be 
presented are polynomial in that generator matrices of them can be produced with 
polynomial complexity as the conjugate codes in [SJ. 

3. Theme. Consider a pair of linear codes (Ci, C2) satisfying 

ci c d, (i) 

which condition is equivalent to C-j 1 C C2. The following question arises from an 
issue on quantum cryptography [3j (also explained in [6] [5]): How good both C\ 
and C2 can be under the constraint ([I])? 

We have named a pair (Ci, C%) with ([1]) a conjugate (complementary) code pair, 
or more loosely, conjugate codes. We remark that a CSS quantum code is specified 
by a conjugate code pair (djCa) (put C\ = C\,Ci = C2 in [15] : C\ corrects bit 
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Figure 1. A basic structure of an [[n, k}] conjugate code pair. 

flip errors and C 2 corrects phase errors). CSS codes form a class of algebraic quan- 
tum error-correcting codes called symplectic or stabilizer codes ([TJJ and references 
therein). 

4. Good Codes in a Balanced Ensemble. We can find good codes in an ensem- 
ble if the ensemble is balanced in the following sense (e.g., [5]). Suppose A is an en- 
semble of subsets of F™. If there exists a constant V such that \{C G A | x G C}\ = V 
for any word ieFJ \ {On}, where 0„ G F™ is the zero vector, the ensemble A is 
said to be balanced. 

We will construct a relatively small ensemble B of conjugate code pairs (C\, C 2 ) 
such that both {d | (Ci,C 2 ) G B} and {C 2 | (Ci,C 2 ) G B} are balanced. Let 
T be the companion matrix [18j (the definition can also be found in ,7), or its 
transpose, of a primitive polynomial of degree n over F„. Given an n x n matrix 
M, let M\ m (respectively, M\ m ) denote the m x n submatrix of M that consists of 
the first (respectively, last) m rows of M. We put C{' — {xT l \ kl \ x G F^ 1 } and 

C { 2 %) = {x{T- l Y\ k2 x G ¥ k q 2 } for i = 0, . . . , q n - 2, where M t denotes the transpose 
of M. Then, setting 

B = B(T) = {(C 1 (i) ,C«) |i = 0,...,g n -2}, (2) 
we have the next lemma. 

Lemma 4.1. for integers ki, fc 2 toif/i < n— fc 2 < fej < n and B = B(T) constructed 
as above, any (Ci,C 2 ) G B is a conjugate code pair, and both {Ci | (Ci,C 2 ) G B} 
and {C 2 I (Ci,C 2 ) G B} are balanced. 

Remark. The matrix T may, more generally, be an n x n invertible matrix over 
F q of the following properties, (i) The set {O n , I n , T, . . . , T qn ~ 2 } is closed under the 
addition and multiplication, where O n and /„ denote the zero matrix and identity 
matrix, respectively, (ii) The matrix T has multiplicative order q n — 1. 

Proof of Lemma \4.1\ The condition ([1} is fulfilled since T l T~ % = I n implies that 
the C^ 1 - is spanned by the first n — fc 2 rows of T\ (Consider the situation where 
the matrix equation in Figure[T]is T l T~ % = I n . The picture was drawn for a generic 
conjugate code pair in [J.) 

We can write c[ l) = {yT l \ y G F' ? \ suppy C [1, ki\z}, where supp (yi,...,y„) = 
{i I yi y^z 0}, and [i,j]i = {i, i + 1, . . . , j} for integers i < j. Imagine we list up all 
codewords in allowing duplication. Specifically, we list up all yT l as y and i 
vary over the range {y \ y G F™, supp y C [1, fci]z} and over [0, q n — 2]%, respectively. 
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With y € F£ \ {0} fixed, yT\ i G [0, q n ~ 2 ]z, are all distinct since T l ^ T ] implies 
yT* — yT^ = yT l for some I and j/T' is not zero. Hence, any nonzero fixed word 
in F™ appears exactly q kl — 1 times in listing yT % as above. Namely, the ensemble 
{Ci | (C\,C2) S B} is balanced. Using (T -1 )' in place of T l , we see the ensemble 
of Ci is also balanced, completing the proof. □ 

To proceed, we need some notation. We denote the type of x G F™ by [101 QT] . 
This means that the number of appearances of u G ¥ q in x G F" is nP x (u). The 
set of all types of sequences in ¥ q is denoted by V n (¥ q ). Given a set C C FJ, we 
put M Q {C) = \{y G C | P v = Q}\ for types Q G V n (¥ q ). The list of numbers 
(MQ(C))Q £ -p n (F ) may be called the P-spectrum (or simply, spectrum) of C. For 
a type Q, we put 7q = {y G F™ | P y = Q}. We denote by V(W q ) the set of all 
probability distributions on ¥ q . 

We use the next proposition, which relates the spectrum of a code with its de- 
coding error probability when it is used on the additive memoryless channel charac- 
terized by a probability distribution W on F g , which changes an input iGF, into 
y with probability W(y — x). This kind of error bound has appeared in [T9] while 
the present form is from [5l Theorem 4]. 

Proposition 1. Suppose we have an [n, k] linear code C over¥ q such that 

M Q (C \ {0„}) < a n q K - n \T£ |, Q G V n (¥ q ) 

where 0„ is the zero vector in F™. Then, if a n > 1, its decoding error probability 
with the minimum entropy syndrome decoding is upper-bounded by 

a n \V n (¥ q )\ 2 d~ nE ^ w ^ 

for any additive channel W of input- output alphabet ¥ q , where r = n/n and E T (W, r) 
is the random coding exponent of W defined by 

E T (W,r)= min \D(Q\\W) + \1 - r - H(Q)\ + ]. 

Qev(¥ q ) 

Here, D and H denote the relative entropy and entropy, respectively, and \x\ + = 
max{0, x}. 

In the simplest case where q — 2, the premise of the above proposition reads 'the 
spectrum of C is approximated by the binomial coefficients \Tq\ up to normaliza- 
tion.' By a straightforward argument using Markov's inequality, we have the next 
lemma and estimate for the number of bad codes in ^ below (a proof can be found 
in [15]). 

Lemma 4.2. We have 

Mq(C, \ {0„}) < 2(\V n (¥ q )\ - l)q k *- n \T$\, Q G V n {¥ q ), j = l,2 
for some conjugate code pair (C\,C2) G B. 

The codes C\ and C2 in Lemma |4~21 both attain the random coding exponent by 
Proposition [TJ Thus, we have a conjugate code pair (C\,C2) such that both the 
[n, ki] code C\ and the [n, £2] code C2, used on W\ and on W2, have asymptotically 
vanishing decoding error probabilities, as far as the asymptotic rates are below 
1 - H(Wi) and 1 - H(W 2 ), respectively. 

In fact, a large portion of a balanced ensemble is made of good codes. Specifically, 
let us say an [n, kj] code Cj is A-good if 

M Q (cf \ {0„}) < (\V n (¥ q )\ - l)q- n ^A (3) 
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for all Q G V n (¥ q ), where rj = kj/n. Then, by Markov's inequality, the number of 
codes that are not <7 e "-good in {Cj | {C\,C-2) G B} is at most 

z = [Nq- en \ . (4) 

(i) 

For g £n -good codes Cj , the decoding error probability is upper-bounded by 

Pj = a n q- n ^ w ^- s \ j = 1,2, (5) 
where a n = \P n (¥ q )\ 3 is at most polynomial in n, owing to Proposition [TJ 

5. Quotient Codes and a Closer Look at Theme. We have been seeking a pair 
(Ci,C2) with (fT]) such that both C\ and C2 are good. However, this requirement 
can be weakened slightly. In fact, we are interested in a pair (Ci, C2) such that both 
quotient codes Cx/C^ and C^/C^ are good in the context of cryptography [21 GUIS] 
as well as in that of quantum error correction. 

A quotient code C/B means an additive quotient group C/B, and can be used 
for transmission of information in the following way. We encode a message into 
a member of c G C/B, which has the form x + B, and then transmit a randomly 
chosen word in c. Clearly, if C is J-correcting in the ordinary sense, C/B is (J + B)- 
correcting. For the purpose of transmission of information only, dividing the code C 
by B does not seem meaningful, but this scheme has proved useful for transmission 
of secret information in the presence of eavesdroppers. The role of B may be 
understood as a kind of scrambler. This scenario is due to [20] while the term 
quotient code was coined in [5]. 

As mathematical objects, the conjugate code pairs (Ci,C2) and the quotient 
codes C/B are obviously in one-to-one correspondence: (CijCy <-> Ci/C^, or 
(CijCq) C2IC1. We mean by an [[n, k]] conjugate code pair over F g a pair 
{C\, C2) consisting of an [n, fci] linear code C\ and an [n, ki\ linear code C2 over ¥ q 
satisfying ([T]) and 

k = k\ + &2 — n. (6) 

The number k/n is called the (information) rate of the conjugate code pair (Ci, C2), 
and equals that of quotient code Ci/C^, that of C^/C-j 1 , and that of the correspond- 
ing CSS quantum code. 

The goal is to find a conjugate code pair (Ci,Ca) such that both Ci/Cjf and 
C2/C1 are good on either of the criteria mentioned in Section [TJ If the linear codes 
C\ and C2 are both good, so are Cx/C^ and C2/C1 . Hence, a conjugate code pair 
(Ci, C2) with good Ci and C2 is also desirable. 

6. Concatenated Conjugate Codes. We recall how the concatenation [L\,L2) 
of inner [[n^\ k]] conjugate code pairs (C[ , C^ ) over ¥ g , i = 1, . . . , N, and an outer 
[[A^, if]] conjugate code pair (Di,D 2 ) over ¥ q k was obtained in [7] (the result also 
appeared in [12]) retaining the notation of [ZlIIl]. For j — 1,2, let tt^ be a one-to- 
one Fq-linear map from ¥ q k onto a set of coset representatives of Cj /d l ' ± , where 

1 = 2 and 2 = 1, and nj(x) denote the juxtaposition tt^ (xi) ■ ■ ■ (xjy) G F^" ; ™ 
of nfixi), i G {1, . . . , A}, for x = (u, ,.,%)£Fj, Then, L 3 - = 7r,(^) + 
where cT=0f =1 
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For (£1,2,2) to satisfy the constraint C L\, we need a certain condition on 
7Ti and 7T2. In fact, by a proper choice of tti and 7T2 based on dual bases of ¥ q h and 
the structure of conjugate codes as depicted in Figure [TJ we have the next theorem. 

Theorem 6.1. [7] 

[tti (D^ + Of} 1 - =ir 2 (D 2 ) + Ot, [Tr 2 (Dt) + Ct] X = TTi(Di) + C 2 I . 



7. Polynomial Construction of Codes. Using almost all codes in B(T) as inner 
codes, we will construct the desired codes. The point of the argument below is that, 
by Markov's inequality, all but a negligible number of the inner codes are good 
(Section so that the overall performance is also good [2"T] . 

Theorem 7.1. Let R a be a number that can be written as R a = {r\ + r 2 — 1)(-Ri + 
i?2 — 1) with some r% , r 2 , R\ , R 2 S (0,1], r\+r 2 — l > 0, Ri + R 2 — 1 > 0. Then, we 
have a sequence of [[N a , K ]] conjugate code pairs (£1, £2) over ¥ q such that the rate 
K /N approaches R , a parity-check matrix of L 2 and that of can be produced 
with algorithms of polynomial complexity, and the decoding error probability P c ,j of 
Lj/Ljr, where 1 — 2 and 2 — 1, is bounded by 



lim sup ~ log, P ed > -(1 - R^EiWj,^), 3 = 1,2 

JV„^oo JV Z 



for any additive channels W\,W 2 of input- output alphabet ¥ q , where E(Wj,rj) is 
the random coding exponent E r (Wj,rj). Moreover, we have a polynomial decoding 
algorithm for the quotient code L 2 / . 

Corollary 1. Let a number R a £ (0, 1] be given. Then, we have a sequence of 
conjugate code pairs (£1, £2) satisfying the same conditions as in the theorem except 
the bound on P e ,j, which is to be replaced by 

limsup-— log P eJ > - sup mm (l-Ri)E(Wi,ri), j = 1,2 

JVo^co JV Z ri ,r 2 ,Ri,R 2 ^U. 2 } 

for any additive channels W\,W 2 , where the supremum is taken over {{r\,r 2 , R\, 
R 2 ) e (0, l] 4 I n + r 2 - 1 > 0, i?i + i? 2 - 1 > 0, (n + r 2 - 1)(R 1 +R 2 -1) = R }. 

Remarks. The decoder for L 2 /L^ , as well as the construction of L 2 /L^ , is inde- 
pendent from the channel. The bound in the theorem is also valid for E(W,r c ) = 
max{£ r (W / , r c ), E ex (W, r c )}, where E ex is as in Theorem 4], but in this case, the 
decoder for L 2 /L^ would depend on the channel in general. Here, the decoding 
complexity should be understood as that of quotient codes as described in Section [5] 
or [5], not that of quantum codes. 

Proof. We will construct (L\,L 2 ) by concatenation retaining the notation of 
Section [6l We use almost all (cf ,Cf) in B for inner codes, where is an 
[n, kj) code for all i (j = 1,2). For outer codes, we use polynomially constructible 
geometric Goppa codes of large minimum distance. Namely, we use codes over 
¥ q k , where q k = p rn with some p prime and m even, obtained from function fields 
of many rational places (places of degree one). Specifically, we use a family of 
function fields F v /¥ q k, v = 1,2,..., such that F v /¥ q k has genus g = g v ^ and at 
least N + 1 = iV^.fe + 1 rational places, and assume they satisfy 
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for any v. This is fulfilled, e.g., by the second Garcia-Stichtenoth tower of function 
fields [H] with g < q kv ' 2 and N as in ^ below. (We remark unlike typical situations 
where we are concerned with the limit of g/N as v — > oo, we fix v here in taking the 
limit. The level v is to be fitted to the target rate of inner codes by ([TO]) below.) 

If we put A = Pi H h P/v, where Pj are distinct rational places in F v /V q k and 

G is a divisor of F„/¥ q k such that supp G n supp A = 0, we have a geometric Goppa 
code Cc(A, G) defined by 

C C (A, G) = {(/(Pi), . . . , /(Pv)) | / e £(G)} 

where £(G) = {x 6 F„ (x) > — G} U {0}, and (x) denotes the (principal) divisor 
of x (e.g., as in p73|. p. 16]). We assume both D\ and D 2 are obtained in this 
way from the function field F u /¥ qk : D 1 = C c {A,Gx) and D 2 = G £ (A,G 2 ) ± . We 
require G2 < G\ so that the CSS condition D 2 C £>! is fulfilled. We also assume 
2g - 2 < degGj < TV for j = 1, 2. Then, the dimension of Di is 

i^i = dim Gi = deg G\— g+1, 

and that of D2 is 

K 2 = N - dim G 2 = N - deg G 2 + .g - 1. 

The designed distance of P/i is iV — deg Gi, and that of D 2 is deg G2 — 2<? + 2. 
We consider the asymptotic situation where for arbitrarily fixed < r*, R* < 1, 

rj d = -> r* and Pj d = ^/iV -v P|, j = 1, 2 (8) 

as n,iV — > 00, using a family of [AT, if^] geometric Goppa codes that fulfills the 
following requirement as well as ([7]). Specific examples of such codes can be found 
in [23j for v > 3 (we can use the RS and Hermitian codes for v = 1, 2) or in [24] , 
We assume that TV grows fast enough so as to be almost as large as the size of B as 
k — > 00. Specifically, for any is, we require 

N = q^+V/ 2 - z' (9) 

for some z' = z' v k such that z'/N — > as k — > 00. By this assumption, if we set 

v = \2n/k] - 1 (10) 

so that q k ( v+1 ">/ 2 > q n — 1 = |B|, we can use all but a negligible number < z' of 
code pairs in B as inner codes. 

For decoding, we first decode the inner codes and then the outer code [7]. Recall 
we have ([5]). Then, employing a decoder that can correct [(^V — Kj)/2\ — g errors 
for the outer codes, we have the decoding error probability P c j of Lj / Lj bounded 

by 

N-z 

PeJ < E ( )P}^-P j ) N - Z - i 
i—t — z 

< Jt-z) log, Pi+(iV-t) lo eq (l-P J ) + (N-z)h((t- z )/(N-z)) 

where z is as in (T5|), ft is the binary entropy function, and t = tj = [(N — Kj)/2\ — 
9 + 1 (for the second inequality, see, e.g., [25l p. 446]). Taking logarithms and 
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dividing by iV = nN , we have 




E(W,r j ) + e + 



logg a 



■11 



n 



log,(l - + 



N - z 



h((t-z)/(N-z)) 



nl N 



N 



for j — 1,2. Hence, letting k — > oo with constraint ([5]) and using ([7]), we have 



Then, since e > is arbitrary, noticing the overall rate is kK/ (nN) = (r\ + r 2 — 
l)(i?i + i?2 — 1), we have the desired bounds in the theorem and corollary. 

We have used a family of geometric Goppa codes Di and for which we 
have polynomial algorithms to produce generator matrices [231 126] . and parity- 
check matrices and generator matrices of concatenated conjugate codes are easily 
obtained from those of Dj [7J. In general, if the outer code Dj is decodable with 
polynomial complexity, so is the concatenated quotient code Lj/Lj [H [7j. For 

our choice [531 [53], D 2 — Cc{A,G 2 ) ± is a 'one-point' code, i.e., the support of G 2 
consists of one rational place, so that we have a polynomial decoding algorithm that 
corrects [(N — K 2 )/2\ — g errors (e.g., [13],[27]). The proof is complete. □ 

We remark that putting constraints Rl — R 2 and r\ — r 2 in (fTT|) . we have a 
weakened but closed form of the bound, which appeared in [12] . 

The highest achievable rate (R such that P e ,j — > for both j — 1 and 2) resulting 
from Theorcm l7.1l is i?css = 1 — H(W\) — H(W 2 ) while the bound in [TJ] mentioned 
above implies the weaker achievable rate i?css = 1 ~ 2 m&x{H (Wi) , H (W 2 )} . The 
achievability of R' css (< -Rcss) by non-constructive conjugate (CSS) codes had been 
established in [JJ and by non-constructive but polynomially decodable conjugate 
codes in [7J. 

The improvement on Rq^ is not novel. In fact, a bound on the error probability 
in (5[ Section 10.3] implies the achievability of i?css by non-constructive codes, and 
the argument of [7J can easily be amended to establish the achievability of i?css 
using a good inner code shown to exist in [SJ Section 10.3]. Lemma l4.2l savs we can 
find good codes in an ensemble much smaller than that of [SJ Section 10.3]. 

We remark that in the extreme case where cf 1 = F™ and D\ = ¥^ k , the quotient 
code L 2 jL\ becomes the classical concatenated code L 2 , and (fTTj) applies even to 
this case. 

8. Summary and Remarks. In this work, conjugate code pairs that are con- 
structive with polynomial complexity were presented. The constructed pairs achieve 
the highest known achievable rate on additive channels. Moreover, the constructed 
codes, as quotient codes, allow decoding of polynomial complexity. We conclude 
with some remarks. 

(I) A polynomial construction of asymptotically good quantum codes was first 
presented in [28]. This adopts the criterion of minimum distance and reflects the 
idea of polynomial constructions of classical algebraic codes ([TJJ and references 
therein). See [S] for attainable minimum distance of concatenated conjugate codes 
or quantum codes of analogous structure, and how it is related to [25]. The present 
work's approach is rather close to that of 21], which presented an explicit construc- 
tion of capacity-achieving codes adopting the criterion of decoding error probability. 



limsup--L log 9 P eJ > 1(1 - R*)[E(W, r*) - e}. 



(11) 
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(II) Though a conjugate code pair is defined as a pair of classical codes, it 
is rephrased as a CSS quantum error-correcting code (Section [3]). Theorem 17.11 
implies that our codes, as polynomially constructible quantum codes, achieve the 
rate i?css = 1 — H(Px) — H{Pj) for the channel that changes a quantum state p 
into X x Z z p(X x Z z )~ l with probability Pxz(x,z), (x,z) G (Z/gZ) 2 = {0,...,q- 
l} 2 . Here, q is a prime, X and Z are unitary operators that represent unit shifts 
in complementary observables (e.g., they are distinct Pauli operators for q = 2), 
and Pu denotes the distribution of a random variable U. (See, e.g., El E] for 
backgrounds.) This holds true for general quantum channels as well [29l 130) . 

(III) This work was motivated by an issue on quantum cryptography, or specifi- 
cally, by the fact that good conjugate (CSS) codes can be used as the main ingredi- 
ents of some quantum cryptographic protocols as argued in [3j 2J [6] . The security 
of such protocols using our codes can be evaluated along the lines of [31 0] . 
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